We are trying to develop a GENERIC WAF Rule for SQLI Prevention for WordPress-based websites that can provide some level of effectiveness with a very low probability of having false positives.

From my understanding I think we can provide some level of protection by default using these things:

  1. Matching for table_names, information_schema, etc.
  2. Matching for common SQLI Payload-based keywords like 'UNION', 'SELECT' etc. (This is prone to false positives because of a lot of common English words.) If > 2 matches then we can block.

If required, we can create a rule for each subcategory like Union-based, Error-based, time-based, AND/OR-based.

Like for Blind-based, we can consider the fact that they need to send a higher number of requests.

We are creating a generic rule so we don't expect it to block all bad requests.

SQLI is a serious issue for WordPress plugins mostly because of developers' mistakes and the PHP ecosystem. So, a preinstalled generic rule can provide at least some protection.

Is this a good idea? Is this question too open-ended? Any suggestions?



You must log in to answer this question.

Browse other questions tagged .